CWE-829: Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- zen cart cart, zen-cart zen cart +1 moreZen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability8.1 High
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- ankitects ankiAnki Latex Incomplete Blocklist Vulnerability5.3 Medium
- ethyca fidesInclusion of Untrusted polyfill.io Code Vulnerability in fides.js0.0 None
- apache http server, netapp clustered data ontap +1 moreApache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect9.8 Critical
- silabs emberznet sdk, silabs.com ember znet sdk +1 moreZigbee co-ordinator realignment packet may lead to denial of service7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreOffscreen Canvas did not properly track cross-origin tainting, which could be used to access...6.1 Medium
- melapress login securityWordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability4.9 Medium
- easydigitaldownloads easy digital downloads, wow-company easy digital downloads – recent purchases +1 moreWordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability9.6 Critical
- tp-link ac1350 wireless mu-mimo gigabit access point (eap225 v3), ac1350 firmware, eap115 firmware +3 more +5 moreA command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link...8.1 High
- tp-link ac1350 wireless mu-mimo gigabit access point (eap225 v3), ac1350 firmware, eap115 firmware +3 more +5 moreA command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link...8.1 High
- kozea weasyprint, fedoraproject fedora +1 moreWeasyPrint allows the attachment of arbitrary files and URLs to a PDF7.4 High
- composerCode execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer8.8 High
- hyperledger ursaUnlinkability broken in ursa when verifiers use malicious keys3.3 Low
- backupbliss backup migrationThe Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0...8.1 High
- anyscale rayRay has arbitrary code execution via jobs submission API9.8 Critical
- wpn-xm serverstack, wpn-xm +1 moreInclusion of Functionality from Untrusted Control Sphere in WPN-XM Serverstack7.5 High
- yettiesoft vestcertYettiesoft VestCert Remote Code Execution Vulnerability8.4 High
- ocomon project ocomonA local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows...8.8 High
- lavasoft web companionM-Files Web Companion allows Remote Code Execution8.6 High
- hyno dropbox folder shareDropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion9.8 Critical
- docker desktopDocker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog8.0 High
- apache airflow hdfs providerApache HDFS Provider error message suggested installation of incorrect pip package7.8 High
- php-fusion phpfusionLocal file Inclusion (LFI) in Forum Infusion via Directory Traversal8.8 High
- schweitzer engineering laboratories sel-5030 acselerator quickset software, selinc sel-5030 acselerator quickset +1 moreInclusion of Functionality from Untrusted Control Sphere5.9 Medium
- schweitzer engineering laboratories sel-5030 acselerator quickset software, selinc sel-5030 acselerator quickset +1 moreInclusion of Functionality from Untrusted Control Sphere5.5 Medium
- apache airflow spark providerApache Airflow Spark Provider Deserialization Vulnerability RCE8.8 High
- ovarro tbox lt2, tbox ms-cpu32, tbox rm2 +8 more +10 moreThe affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration...7.2 High
- gvectors wpforo forumwpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents8.8 High
- bumsys project bumsys, unilogies unilogies/bumsys +1 morePHP Remote File Inclusion in unilogies/bumsys7.2 High
- checkmkRemote Code Execution with Root Privileges via Broad Apache Permissions8.8 High
- xunruicmsXunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows...7.2 High
- openstack glance, redhat openstack +1 moreOpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability2.8 Low
- gradleGradle usage of long IDs for PGP keys opens potential for collision attacks6.6 Medium
- hybrid software cloudflowCloudflow - Local File Inclusion Vulnerability8.3 High
- samsung android, samsung mobile devices +1 moreImproper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1...6.2 Medium
- ge inet 900 firmware, inet ii 900 firmware, sd1 firmware +5 more +7 moreCertain General Electric Renewable Energy products have a hidden feature for unauthenticated...9.8 Critical
- amitmerchant1990 markdownifyMarkdownify subject to Remote Code Execution via malicious markdown file7.8 High
- juniper junos, juniper networks junos os +1 moreJunos OS: PHP file inclusion vulnerability in J-Web7.5 High
- cuppacmsThe component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user...6.5 Medium
- cuppacmsCuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the...7.5 High
- iconics genesis64, mitsubishi electric iconics suite, mc works64 +2 moreInclusion of Functionality from Untrusted Control Sphere vulnerability in ICONICS GENESIS64...7.8 High
- honeywell alerton ascent control module firmwareHoneywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated...8.0 High
- honeywell alterton visual logic firmwareHoneywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from...8.8 High
- gradleGradle's dependency verification can ignore checksum verification when signature verification cannot be performed6.6 Medium
- google android, samsung mobile devices +1 moreImproper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1...3.3 Low
- eclipse equinox p2, the eclipse foundation eclipse equinox p2 +1 moreIn Eclipse p2, installable units are able to alter the Eclipse Platform installation and the...10.0 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn iframe that was not permitted to run scripts could do so if the user clicked on a <code...8.8 High
- progress whatsup goldIn Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an...6.5 Medium
- discourseAnonymous user cache poisoning in discourse5.3 Medium
- Show moreLoading…